How to Spot Brand Impersonation Online: An OSINT Checklist Backed by FTC and APWG Data

Brand impersonation rarely announces itself. A shop opens using a familiar name and a slightly different domain. A social account copies a logo and a bio. An email arrives from an address that reads correctly at a glance. Each piece looks small on its own; together they form a pattern that costs real money, and the cost keeps rising.

This guide sets out what the current fraud data says about the scale of the problem, a repeatable checklist for spotting impersonation across domains, social accounts and messages, and a worked walkthrough using a safe, reserved brand name so the method is visible without pointing at anyone real.

Where the numbers come from. Fraud figures are taken from the Federal Trade Commission’s 2025 imposter-scam data release (published June 2026) and the Anti-Phishing Working Group’s Phishing Activity Trends Report for Q2 2026. The domain-variant counts further down were generated and counted ourselves on November 4, 2026, using the same substitution, repetition and transposition logic published open-source tools like dnstwist use; no real brand or live domain was queried.

Why This Is Bigger Than a Few Fake Accounts

The Federal Trade Commission’s Consumer Sentinel data, released in June 2026, shows imposter scams were the most reported fraud category in the United States for the ninth year running. People filed more than one million imposter-scam reports for 2025, and reported losses reached $3.5 billion, up nearly 20% from the year before. Within that figure, business impersonators (someone pretending to represent a company) accounted for about $1 billion, with bank impersonation the single costliest type. Government impersonation added another $920 million, up from $789 million in 2024.

The supply side tells a matching story. The Anti-Phishing Working Group (APWG) counted 1,069,681 unique phishing sites in the second quarter of 2026, up 10.1% from the first quarter, and the highest quarterly figure since mid-2025. June alone accounted for 425,808 sites, the highest single month since April 2023. The number of distinct brands targeted rose from 766 in Q1 to 941 in Q2.

Chart 1: Where the fraud losses land

Chart 2: Phishing sites, quarter over quarter

Two things stand out. First, the losses are concentrated in categories that depend on borrowed trust: a bank, a government agency, a known business. Second, the number of distinct brands being targeted is rising faster than the number of sites, which means the problem is spreading across more targets rather than concentrating on a few.

The Checklist: Domains, Social Accounts, Messages

1. Domain checks

• Registration age. A domain registered in the last few weeks and already running a full storefront or login page is a stronger signal than age alone would suggest. Query the public registry (RDAP or WHOIS) for the registration and last-changed dates.
• Name server and hosting pattern. Copycat sites often cluster on the same budget hosts or name-server providers because the operator reuses infrastructure across multiple fake domains.
• String distance from the real brand. Character substitution (paypa1.example), repetition (paypall.example), omission, and added words (paypal-support.example) are the standard patterns. See the walkthrough below for how fast this space grows.

2. Social account checks

• Creation date versus posting history. A profile created last month with five years of backdated-looking posts, or one with a sudden burst of recent activity after years of silence, both deserve a second look.
• Reciprocal links. A genuine brand account is usually linked to and from the brand’s own website. A copycat account is not, even if it copies the bio text exactly.
• Avatar history, not just the current image. Reverse-image search the avatar. The same image appearing under several different account names is a stronger signal than a name match alone.

3. Message and contact checks

• Urgency plus a request to move money or verify by moving money. This single combination is behind most of the losses in the FTC’s government and business impersonation figures above. No legitimate bank or agency asks you to transfer funds to “protect” them.
• Contact channel mismatch. A message that starts on one channel (a text) and asks to continue on another (a call to a number it supplies) is a known pattern for moving the victim away from a channel with fraud controls.
• Independently verified callback. Always use a number or address you already had on file, not one provided in the suspicious message.

A Walkthrough: How Fast the Variant Space Grows

To show why domain monitoring cannot be done by hand, we ran the same three generation rules that typosquat-detection tools such as the open-source dnstwist (5,773 GitHub stars as of April 2026) use, against a 12-character placeholder brand name. No real brand or live domain was involved.

That is 323 lookalike strings from one brand name, one TLD, and the simplest edit rules. Add a second TLD, a hyphenated variant (-support, -login, -verify), and the count moves into the thousands before anyone has registered anything. That is the actual case for monitoring tools that watch registries continuously, since a person checking by hand cannot keep pace with a space that size, and a brand that only reacts after a complaint has already lost the head start.

A Worked Scenario

The following is a constructed example, using reserved .example domains, to show how the checklist comes together.

A regional retailer, “Harlow & Vance”, is told by a customer that they received a shipping confirmation for an order they never placed.

1. Domain check: the confirmation email links to harlow-vance-orders.example, registered nine days ago, hosted on a budget provider the retailer does not use. Signal: strong.
2. Social check: a search for the retailer’s handle turns up a near-identical account created three weeks ago, using the same logo but a bio with a different contact email. Signal: strong.
3. Cross-check: the fake site’s checkout page requests payment by bank transfer only, which the real retailer never does. Signal: strong, and consistent with the FTC pattern of urgency plus an unusual payment method.
4. Action: the retailer preserves screenshots and the domain registration record, reports the social account for impersonation, and files a takedown request with the hosting provider, citing the registration date and the mismatched contact details as evidence.

Three independent signals agreeing, each tied to a dated, sourced observation, is what turns “a customer complained” into a takedown request a platform or registrar will act on.

Video: How Impersonation Scams Work, From the Regulator

The FTC publishes short consumer-facing videos explaining specific impersonation patterns. The one below covers a government-impersonation scam and the exact urgency-plus-payment pattern described above.

Where Username and Email Checks Fit In

Once a suspect domain or account surfaces, the next question is usually whether the same operator runs others. A username search can show whether the handle used on the fake account also appears elsewhere, which is how single copycats turn into a mapped network; our username footprint guide covers that process in depth. An email check on the contact address behind a suspicious domain can show whether it is a fresh, single-purpose address or one with a longer public history. Both are OSINT and SOCMINT steps, not proof on their own, and both belong in the evidence log alongside the domain and social findings, not instead of them.

Good Practice Before You Act

• Record the dated evidence first. Screenshot the page, the registration record and the account before reporting, since the content you are reporting may be edited or removed.
• Do not interact with the impersonator. Confronting a copycat account can alert the operator to move infrastructure before you capture evidence.
• Verify through a separate channel. Call a number you already had, not one given in the suspicious message.
• Report through the right channel. Platforms have impersonation-specific report flows; registrars and hosts respond to abuse reports with evidence attached; consumers should also file with the FTC at ReportFraud.ftc.gov.

References

• FTC: People Reported Losing $3.5 Billion to Imposter Scams in 2025, June 2026
• FTC Consumer Advice: New Trends in Reports of Imposter Scams, May 2026
• APWG Phishing Activity Trends Report, Q2 2026 (PDF)
• dnstwist: domain name permutation engine (Apache-2.0), referenced for its generation methodology, GitHub star count checked November 4, 2026
• IRS Imposter Scams, Federal Trade Commission (YouTube)
• ReportFraud.ftc.gov
• Mapping a Username Footprint Across Thousands of Sites and How to Find Websites Associated With an Email Address on this site